xalgorix v4.5.123

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

pipelock v3.3.0

Pipelock Open-source AI agent firewall forVerifiable Egress Control. !pipelock...

openSUSE 16: java-25-openjdk / java-25-openjdk-demo / java-25-openjdk-devel / etc (openSUSE-SU-2026:21467-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21467-1 advisory. - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of...

📄 velocityjs 2.1.5 Prototype Pollution

A proof of concept exploit for velocityjs versions 0.3.1 through 2.1.5 that contain a prototype pollution vulnerability. The exploit abuses an unvalidated set left-hand path to write arbitrary properties into Object.prototype, enabling authorization bypasses and, on Node.js 16 and earlier,...

📄 Snipe-IT 8.4.0 Authorization Bypass

A proof of concept exploit for Snipe-IT versions 8.4.0 and earlier that contain an authorization bypass vulnerability. The exploit abuses insufficient permission checks on the file upload API to allow a view-only user to upload arbitrary files to accessible objects. On deployments that permit...

PT-2026-66757

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

📄 DbGate 7.1.8 Remote Code Execution

A proof of concept exploit for a DbGate 7.1.8 unauthenticated remote code execution vulnerability. The exploit abuses the /runners/start endpoint by injecting JavaScript through the JSON script runner's functionName field, allowing arbitrary operating system commands to be executed and their outp...

openSUSE 16: java-21-openjdk / java-21-openjdk-demo / java-21-openjdk-devel / etc (openSUSE-SU-2026:21470-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21470-1 advisory. - CVE-2026-41254: Information disclosure or denial of service via integer overflow in CubeSize bsc1264994. - CVE-2026-46917: partial denial of...

openSUSE 16: libpython3_13-1_0 / libpython3_13-1_0-x86-64-v3 / libpython3_13t1_0 / etc (openSUSE-SU-2026:21459-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21459-1 advisory. Changes in python313: Update to 3.13.14: - Security - gh-151159: Bumps the OpenSSL version to 3.0.21 on Android. - gh-150599: Fix a possible sta...

javapackages-tools:201801 security update

ant-contrib 1.0-0.32.b3 - Rebuilt for https://fedoraproject.org/wiki/Fedora28MassRebuild 1.0-0.31.b3 - Rebuilt for https://fedoraproject.org/wiki/Fedora27MassRebuild 1.0-0.30.b3 - Rebuilt for https://fedoraproject.org/wiki/Fedora26MassRebuild 1.0-0.29.b3 - Rebuilt for...

CVE-2026-11374-check — Updated!

CVE-2026-11374 ManageEngine AD360 Precondition Detection Script A detection script for the exploit precondition of CVE-2026-11374, a predictable SSO-ticket flaw that leads to unauthenticated account takeover across the ManageEngine AD360 suite. The four in-scope products share the...

jsoup:CssHtmlFuzzer: Security exception in com.google.re2j.Machine$Queue.<init>

Project: https://github.com/jhy/jsoup.git Detailed Report: https://oss-fuzz.com/testcase?key=5963112204533760 Project: jsoup Fuzzing Engine: libFuzzer Fuzz Target: CssHtmlFuzzer Job Type: libfuzzerasanjsoup Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...

openbabel:fuzz_convert: Heap-buffer-overflow in OpenBabel::TSimpleMolecule::redraw

Project: https://github.com/openbabel/openbabel.git Detailed Report: https://oss-fuzz.com/testcase?key=5121501851090944 Project: openbabel Fuzzing Engine: libFuzzer Fuzz Target: fuzzconvert Job Type: libfuzzerasanopenbabel Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address:...

libiec61850:fuzz_mms_encode: Heap-buffer-overflow in BerEncoder_encodeBitString

Project: https://github.com/mz-automation/libiec61850.git Detailed Report: https://oss-fuzz.com/testcase?key=4812125491757056 Project: libiec61850 Fuzzing Engine: libFuzzer Fuzz Target: fuzzmmsencode Job Type: libfuzzerasanlibiec61850 Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1...

GHSA-HF3J-86P7-MFW8 AWS Amplify Studio UI Component Properties Has an Input Validation Issue

Summary The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities components, forms, views, and themes primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface AWS CLI for generating component files in...

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

Summary The AWS Amplify Studio amplify-codegen-ui is a package that generates front-end code from UI Builder entities components, forms, views, and themes primarily used in AWS Amplify Studio for component previews and in AWS Command Line Interface AWS CLI for generating component files in...

xalgorix v4.5.119

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

Exploit for CVE-2026-61424

CVE-2026-61424 — DJ-Classifieds imageupload Task → No Auth → 3-...

Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f5e3f7f8e637ac814a5040b2e61c8608327f73b1c44352e694848a8c35e181 On import, server.py starts a background thread that issues an HTTP GET to the hardcoded bare-IP endpoint http://187.127.73.142:8777 carrying a...

MAL-2026-11198 Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f5e3f7f8e637ac814a5040b2e61c8608327f73b1c44352e694848a8c35e181 On import, server.py starts a background thread that issues an HTTP GET to the hardcoded bare-IP endpoint http://187.127.73.142:8777 carrying a...